The npm package 'block_package' version 1.0.0 contains malicious code in its postinstall script. This script automatically downloads and executes an MSI installer from an untrusted HTTP source without verification, allowing arbitrary code execution on the installing machine.